working with a client who wants to considering using SCM in cloud rather than Panoram on prem. Anyone else do this? any input or lessons learned?

What version of Global Protect do you really prefer and why?

We are running 6.2.8-h6 (c431), but I see 6.2.x ends in a little over a year, so in theory we should be going to 6.3.x at some point, yet I do not see a preferred release of it despite 6.3.x being released first in mid 2024.

What is going on and what do all of you prefer? I see that there are 6.3.x-(c1000+) now is why I am asking. Presumably there is something better or more secure. Can someone chime in?

Sources and background info for this question:

https://live.paloaltonetworks.com/t5/customer-resources/pan-os-globalprotect-amp-user-id-preferred-release-guidance-from/ta-p/258304

https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary

Hello,

This is driving me nuts and looking for some assistance. I recently set up a new policy (ID 188) and am having issues getting traffic to properly hit it and I am not sure why.

I have the two following policies configured:

https://preview.redd.it/x02ut6fspq2h1.png?width=1676&format=png&auto=webp&s=6c721475dea75a73eba857a0431e2ef2623e69ad

Traffic matching policy 129 looks like the following:

https://preview.redd.it/y3e36irxpq2h1.png?width=1870&format=png&auto=webp&s=5b9e107852dfc7c3fe7f10f71ce2dc1e50d962ab

Traffic matching policy 188 looks like the following:

https://preview.redd.it/vojg3sb2qq2h1.png?width=1870&format=png&auto=webp&s=1685aa53c3cbf866e913939cb8b2e938b9b14258

https://preview.redd.it/40q2gj48qq2h1.png?width=1870&format=png&auto=webp&s=b08a739b519f27034eefe5579f79a2a14645a469

On policy 188, I initially had it configured with application of 'ssl' and 'web-browsing' with service set to 'application-default' which didn't work. I then changed application to 'any' and set the services to 'tcp/443 and tcp/80' this didn't work either. I finally tried setting application to 'any' and services to 'any' and that is not working either!

It seems like maybe the initial handshake isn't completing or the firewall isn't seeing enough in the initial packet(s) to start looking further down the policy stack, but I am not sure why. I have other sites with the exact same set up using the application of 'ssl' and service of 'application-default' and those work just fine. Maybe I am just not understanding something correctly but I feel like I am going insane with this.

Thanks!

Hi all, I did some research on this but can't seem to find an answer. I understand you can export the XML config from the firewall and import it back, but some of the tools I use take backups by running show config running which gives the JSON-like commands output. Is there a way to restore this config to the firewall, or do I need to have the XML file? TIA

Hi,

We are running Palo Alto Firewalls as our main ips Firewall. Since the past years our strategy has been allowing port 80 and 443 and filter application SSL and web browsing. But nowadays we are dealing with lots of separate applications, for example AI applications or even websites like ecosia.org now have their own application signature. Our web browsing rule now has over 80 different apps in it and it's growing, resulting in many unwanted tickets for: please fix this web application access.

Is this how it's designed, or how we could build a rule that has more of a blacklisting approach than whitelist but without allowing harmful applications on 443?

Of course I could build 2 rules with disallow everything unwanted and a second allow rule with application any in it. But this doesn't filter anything I don't know about.

So basically our security policy is: everything that is HTML / a normal website, is okay, but we don't want to allow things like Teamviewer or ssh or any unknownen non Web applications

We are not allowed to do SSL inspection by the way

Just wanted to give everyone else a heads up, after upgrading from 11.1.13-h3 to 11.1.13-h5 we were no longer able to connect to globalprotect gateways, it turns out that 11.1.13-h5 enables this setting by default: > show global-protect enable-auth-override-cookie-hmac > > Enable auth override cookie HMAC flag: yes

and if its not enabled every where (all portals and all gateways) it will cause 'cookie decrypt' errors when trying to connect to that gateway.

The fix was simple but annoying, after upgrading login to each firewall and issue the command or upgrade all firewalls at once and have this setting enabled everywhere > set global-protect enable-auth-override-cookie-hmac no

Edit: I checked with TAC based on comments and was told that this should only be used long enough to get everything upgraded, once upgrade the HMAC setting should be turned back on

Hello, since the last thread protection update we see that a lot of dhcp traffic is reseted by the firewall because of thread ID 97011 which is related to dlink dhcp problems. We dont use dlink devices at all. Does anyone have experienced similar topics?

So we migrated our panorama instance from VMware to hyper-v. I took a configuration snapshot before I started. We exported the sc3 certificates. Followed the instructions from Palo Alto. Pretty much to a kept the same IP address and host name. Got it all loaded back up and the log collector doesn't seem to be displaying on the monitor tab. So I went and I looked at the log collector and the log collector. At first it was saying that there it was ingesting logs. Then after I messed with it a little bit it stopped ingesting logs. I rebooted panorama after doing a bunch of stuff and it seems like it's ingesting again. But still nothing is showing up on the monitoring tab. Anyone else seen this.

Hello

I have active active deployment using floating ips and one of the vsys which active in the node 0(active primary) is the internet Vsys

From the active secondary(node1) i cant reach the internet using its interface a ping source

I need to get updates from updates.paloalto.com

Also i cant even ping google.

So the internet vsys should be active on the secondry firewall in order to for it reach the internet ?

Hello,

Since 10.2 EOL has just been extended. We haven't decided whether to go to 11.1 or 11.2. The safety bet maybe just upgrade to the latest hotfix version.

We have both 5400 chassis and 5400f, 3410, 52x0, 4x0 series. No VM.

Why pick 11.1 not 11.2? Both have the same end-of-support date [off by 1 day]? TIA!

We are currently looking at the possibility of using Sectigo or SCEP to automate our Global Protect certificates but the problem we are running into is that the Portal and Gateway configs have pointers to the cert so the whole process cannot be automated or can it? Has anyone been doing anything like this?

Hi Guys,

I’m looking for a solution to restrict Linux endpoints from connecting through GlobalProtect.

Has anyone implemented this before or have any recommendations/best practices? Any advice would be appreciated.

Thanks

Hi guys,

Is there any way to check how many Linux endpoints are using the GlobalProtect VPN?

I’m trying to identify users connecting from Linux machines.

Any one run into the same issue whose work laptop utilizes GlobalProtect VPN and can’t access company programs unless it’s on and T-mobile 5g home internet.

Company IT team says it’s tmobiles fault.
T-Mobile says settings can’t be changed.

Please please help me out. Need to do my work.
For those with this issue how did you fix it?

Hello,

Have you tried integrating Intune with Global Protect? I know its pretty lazy question, but it would be very helpful if someone did it.

Here we go again.

docs.paloaltonetworks.com seems to be DoS'ed out, so heavens know what they have fixed today.

Seems like just 8 days ago the last hotfixes came out. We have the last releases in Test, but haven't rolled to Prod. Guess we'll be skipping the last and going to these.

The PAN-OS 11.1.7-h6, 11.1.10-h26, 11.1.13-h6, 11.2.4-h17, 11.2.7-h15 & 11.2.10-h8 software updates are now available on the Palo Alto Networks Software Updates page.

Check out the following Release Notes for release details, including the new features and bug fixes that make the upgrade worthwhile:

• 11.1.7-h6 (Long list of CVEs)
• 11.1.10-h26 (fixes for Eth1/1 data port and PoE ports, don't use -h25)
• 11.1.13-h6 (fixes for Eth1/1 data port and PoE ports, don't use -h5)
• 11.2.4-h17 (Long list of CVEs)
• 11.2.7-h15 (fixes for Eth1/1 data port and PoE ports, don't use -h14)
• 11.2.10-h8 (fixes for Eth1/1 data port and PoE ports, don't use -h7)

CVEs:

• CVE-2026-0265
• CVE-2026-0264
• CVE-2026-0263
• CVE-2026-0262
• CVE-2026-0261
• CVE-2026-0258
• CVE-2026-0257
• CVE-2026-0256
• CVE-2026-0259
• CVE-2026-0300